How CADMID, approvals and assurance fit together
CADMID describes the lifecycle. Approvals and assurance are separate layers on top of it, and the two are easy to confuse.
Investment approval in the MoD runs through two main points. Initial Gate comes at the end of Concept and approves the project to move into Assessment, supported by a Strategic Outline Case or Outline Business Case depending on the project. Main Gate comes at the end of Assessment and approves the Full Business Case. Both go through the Investment Approvals Committee, and the business case is prepared against JSP 507, the MoD's investment appraisal and evaluation guidance, which in turn sits under the HM Treasury Green Book. There is no approval at every phase transition.
Separately, NISTA (formerly the IPA) runs Gateway Reviews, Gate 0 to Gate 5, on projects in the Government Major Projects Portfolio. NISTA replaced the IPA in April 2025. Gateway Reviews are independent peer reviews and they sit alongside MoD approvals, not in place of them.
CADMID is still the vocabulary most defence controls teams use. The Integrated Procurement Model, published in February 2024, changes how the MoD organises acquisition, and the Authority may use different phase names or approval wording on a given programme. Confirm which terms your programme uses before you build a controls plan around any of these labels. This guide uses CADMID because it remains the common frame for describing what controls must deliver and when.
The NAO reports on defence equipment and on individual programmes. Its findings on cost growth and delay in the Equipment Plan are the reason reviewers press hard on contingency and through-life cost.
What controls must deliver at each phase
At Concept, the controls contribution goes into the business case: cost and time estimates that reflect how little is defined, structured so that options can be compared and the main drivers of uncertainty are visible. This is where controls most often arrives late.
At Assessment, the design is developed far enough to select a solution and set a cost and schedule baseline. Controls should produce a cost estimate at AACE Class 4 or better for the preferred option (see AACE RP 17R-97, Cost Estimate Classification System), a programme covering Demonstration and Manufacture at a level that supports Main Gate, and a risk register with three-point estimates for the threats and opportunities that matter. The QRA from this phase usually sets the contingency for the next.
At Demonstration, the solution is proven and the Manufacture programme is confirmed. Controls maintains the performance measurement baseline, updates the QRA as technical risk resolves or fails to, and runs change control as the design matures. On MoD equipment contracts, change goes through the contract's own amendment mechanism, using the MoD's standard conditions (DEFCONs and DEFFORMs), not NEC compensation events. NEC4 is widely used on Defence Infrastructure Organisation works, and on those contracts early warnings and compensation events apply as normal.
At Manufacture, exposure and controls intensity are both at their highest. Where the contract calls up earned value management, the controls function maintains an integrated cost and schedule model and reports to the cadence in the contract. It also gives the delivery lead the leading indicators needed to act before a problem becomes a crisis.
At In-service, controls tracks through-life cost over decades. At Disposal, it carries the cost, commercial and regulatory complexity of withdrawal, which is greatest on radiological or environmental platforms.
What reviewers test at gate
Reviewers at Initial Gate, Main Gate and a NISTA Gateway Review ask different questions, and the controls evidence that answers them shifts accordingly. The mapping below is indicative.
At Initial Gate and Gateway 1 the question is whether the cost and time ranges are honest and the option set has been genuinely compared, not engineered towards a preferred answer. At Main Gate the question is whether the Full Business Case is affordable and deliverable: whether the baseline is achievable, whether the supply chain has the capacity, and whether the contingency is defensible. At Gateway 3 the question is investment confidence immediately before commitment, including whether the risk transfer to the contractor is realistic. At Gateway 4 it is readiness for service.
Some signatures are recognised quickly. A QRA whose P80 sits close to the funding envelope. A risk register with fifty risks that share one probability and impact score. A schedule constrained to show the required end date without the logic that would deliver it. Optimism bias added as a late uplift, so a reviewer can strip it out and see the underlying model. EV and actual cost lines that track each other almost exactly. A through-life cost model not refreshed since the business case.
The schedule problem deserves precision. A critical path cannot run through float. The real faults are hard constraints (Must Start On, Must Finish On, Start No Later Than, Finish No Later Than) that pin activities and hide the true longest path, negative float that has been tolerated, out-of-sequence progress, open ends, and a path the team believes is critical that is not the longest path. The DCMA 14-point assessment is a widely used diagnostic for these. It is a US Department of Defense origin check, not an MoD requirement. The checks that matter most before a gate are logic (missing predecessors or successors at or below 5%), hard constraints (at or below 5%), negative float (zero), the critical path test, the Critical Path Length Index (0.95 or higher) and the Baseline Execution Index (0.95 or higher). Treat them as prompts for questions, not as a pass mark.
On the Green Book, the current 2026 edition requires optimism bias and risk to be addressed in appraisal. It does not mandate a particular percentile. Where a QRA already prices a risk, make sure the same exposure is not also covered by an optimism-bias uplift, and state in the business case how the two have been separated. A reference class comparison against similar programmes is the most effective check on first-principles estimates.
Gate-evidence checklist
This is the test SOMA applies to controls evidence before a gate. Reviewers do not set it, and none of it is an MoD requirement.
1. Traceability. Every number in the gate paper ties back to a model file, workshop output, contract data line or audited cost report.
2. Stated assumptions. Each key assumption is written down and tested by sensitivity analysis, so a reviewer can see how the conclusion moves when it is flexed.
3. Inputs, not adjustments. Uncertainty is in the input ranges. Optimism bias and any reference class uplift are shown separately and are not hiding a narrow model.
4. Option maturity. Ranges differ between options in line with how mature each is (see the worked example below).
5. Schedule health. The DCMA 14-point results are available, hard constraints are justified, and the longest path is identified without relying on constraints.
6. Contingency drivers. The team can name the three things that, if they went wrong, would breach the contingency provision, and how each is managed. Our view is that a controls team which can answer that without referring back to the model understands its own analysis.
7. Currency. The through-life cost model and QRA reflect the current configuration and baseline, not the version approved at the previous gate.
Earned value on MoD contracts
Whether a contract requires earned value management, and to what standard, is set in the contract itself and varies by programme. Where it applies, the usual reference points are ANSI/EIA-748 (current revision), which sets the 32 guidelines for an EVM system, ISO 21508:2018, Earned value management in project and programme management, and the APM Earned Value Management Handbook. AACE RP 11R-88 is not an EVM standard. It covers required skills and knowledge of cost engineering. Check the contract's Schedule of Requirements and the Authority's own instructions for what is called up.
In practice the requirement is a work breakdown structure that maps to the contract and the technical scope, a PMB that integrates authorised scope, budget and schedule, a budget on every control account with a defined earned value measurement technique, and a monthly report of planned value (PV), earned value (EV), actual cost (AC), SPI, CPI and EAC in the contract's format. The older labels BCWS, BCWP and ACWP mean the same as PV, EV and AC. Under EIA-748 the PMB is control accounts, summary-level planning packages and undistributed budget. Management reserve sits outside it. Budget at completion (BAC) is the numerator in EAC = BAC / CPI when that formula is used.
One trap catches many reports. SPI measured in value terms converges to 1.00 at completion by construction, because all planned value is eventually earned. A late SPI near 1.00 therefore says little about schedule health. Use earned schedule, SPI(t) = ES / AT (earned schedule divided by actual time), which does not converge in the same way.
The commonest failure is the gap between the contract-required EVM system and the planning system the team actually runs. The cost tool and the scheduling tool are reconciled by hand at month end, and the reconciliation is where errors enter and where the data loses contact with delivery. An integrated system, with the schedule driving PV and measured progress driving EV, is harder to set up and produces data that is useful, not merely compliant.
Security classification affects who can access the reporting system and how data moves to the Authority and to uncleared subcontractors. Establish the classification and its handling rules before you design the system.
Where the SSRO fits
The Single Source Regulations Office is the statutory regulator for the single source regime, set up under the Defence Reform Act 2014 and operating under the Single Source Contract Regulations 2014. It applies to qualifying defence contracts let without competition. Its work covers allowable costs, the baseline profit rate, contract reporting and referrals of disputes. Contractors report through DefCARS: the Contract Pricing Statement, Contract Reporting Plan, Quarterly Contract Report, and the Interim and Final Contract Reports.
The SSRO does not run gate reviews, audit EVM systems or require a QRA. MoD cost assurance is a separate function. Check current thresholds and any change from the Procurement Act 2023 before relying on them for a specific contract.
Common controls failure modes by phase
Failure modes cluster by CADMID phase. At Concept, the pattern is a cost estimate that ignores option-set uncertainty. The team produces what looks like a three-point range, but every option carries the same percentage uncertainty regardless of technical maturity. A bespoke airframe and a military off-the-shelf (MOTS) variant cannot sensibly share one coefficient of variation. Reviewers familiar with AACE classification will press on exactly that, and on the lack of a reference class.
A worked example shows the effect. Take two options. Option A is a bespoke airframe with a most likely cost of £600m. Option B is a MOTS variant at £520m. If both are given the same range of minus 15% and plus 25%, Option A runs from £510m to £750m with a triangular mean of (510 + 600 + 750) / 3 = £620m. Now set ranges by maturity. Option A, being new design, gets minus 20% and plus 60%: £480m, £600m, £960m, with a mean of (480 + 600 + 960) / 3 = £680m, a standard deviation of £102m and a coefficient of variation of 15.0%. Option B keeps minus 15% and plus 25%: £442m, £520m, £650m, with a mean of £537.3m, a standard deviation of £42.9m and a coefficient of variation of 8.0%. The flat range understated Option A's expected cost by £60m (680 - 620) and hid the fact that its uncertainty is nearly twice that of Option B. The percentages are illustrative, not benchmarks. In a real analysis they come from the option's technical maturity, a reference class and a calibrated estimate.
At Assessment, the pattern is a QRA that fails Green Book scrutiny. The input ranges are narrow, correlation is absent or token, the opportunity side is empty, and the P80 sits close to the deterministic estimate. When a reviewer removes the late optimism-bias uplift, the uncertainty has been engineered away. MoD cost assurance will challenge a distribution that looks too tame for the programme's maturity.
At Manufacture, the pattern is EVM reports that drift from delivery reality. SPI and CPI sit close to 1.00 for months, then correct in a step at a milestone or an independent review. The usual cause is self-reported progress from package managers who have an incentive to show momentum, with earning rules that are undocumented or inconsistently applied, so EV is closer to forecast than to physical fact. The fix is documented earning rules per work package, physical progress measures where possible, and a periodic independent check of EV against evidence.
At In-service, the pattern is a through-life cost model not refreshed since contract award. It misses obsolescence, capability upgrades and the disposal liability. Electronic components on a thirty-year platform reach end of life several times, and the cost of redesign, requalification and retest is rarely modelled at Concept. A model that assumes today's configuration persists is optimistic by construction. NAO reports on long-running equipment have repeatedly found support costs growing beyond the business case figure, and an unreconciled model is part of the reason.
What good controls looks like in defence
Good controls is integrated and starts early. Schedule, cost and risk work from one data model and give consistent outputs. Controls is in the room from Concept, before the baseline is under pressure. The QRA reflects the risks the programme faces, and not the numbers a board hopes to see.
The function is an early-warning service to the senior responsible owner and the project team leader. It flags deteriorating schedule logic, cost performance trending below 1.0 and risks crystallising faster than the register assumed, while options remain open.
The weak setup is a controls function separated from delivery, seen as overhead, producing a monthly report from data the delivery team does not trust, with the QRA treated as something done before a gate. If that describes your programme, the reports understate your exposure.
How SOMA approaches this
Defence is a sector SOMA can support, using the QSRA and QCRA practice it applies on National Highways and other regulated programmes. Before a gate we test option ranges against maturity, separate optimism bias from modelled risk, run the DCMA 14-point checks and trace each gate paper figure to its source. Some team members have defence experience from earlier roles, which they hold as individuals and not as SOMA engagements.